CVE-2022-39423

What it actually does

High-privileged local attacker with logon access to the host can read critical data from Oracle VM VirtualBox due to a scope-change information disclosure in the Core component.

Why it matters to the business

Exposure of sensitive virtualization data across affected environments; 1460 days since publication with low but slightly rising EPSS indicates persistent risk for organizations still running unpatched versions.

How an attack unfolds

An attacker logs into the infrastructure hosting VirtualBox with high privileges and leverages the Core flaw to read data outside the intended scope, potentially affecting other products on the same system.

How to fix it

Upgrade affected Oracle VM VirtualBox installations to version 6.1.38 or later; apply the referenced GitLab fix commit 9cd657e5179e339171d27e4573b8f5711db1d824 where applicable in integrated environments.

How to confirm the fix worked

Verify running version is at least 6.1.38; confirm no local high-privileged processes can access data outside VirtualBox boundaries via host logs or configuration audits.

Typical attack path

1. Obtain high-privileged local logon to the VirtualBox host
2. Trigger the Core component flaw
3. Read unauthorized critical data with scope change

How to detect it

Review host authentication logs for unexpected privileged sessions around VirtualBox processes; inspect for anomalous data access patterns from the Core component.

What your security team should do

• Prioritize patching all hosts running VirtualBox prior to 6.1.38 within the next maintenance window
• Audit privileged accounts with host logon rights
• Monitor EPSS trend for any acceleration